CVE-2026-92954

A flaw was found in vm2. An attacker capable of running untrusted code within the sandbox can trigger a Denial of Service DoS by causing the host application process to terminate. This vulnerability exists because asynchronous operations Promises returned from the host environment are not properl...

CVE-2026-92958

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

EUVD-2026-81607

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958

vm2 (a Node.js sandboxing library) versions through 3.11.6 contain a builtin-module denylist bypass in NodeVM . When embedders use the wildcard with negative entries (e.g., -fs), matching is done by exact module name in lib/builtin.js, so fs/promises is not blocked. Sandboxed code can therefore c...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958: Improper Privilege Management

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-18149 undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

CVE-2026-19324

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

CVE-2026-19324 HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

Summary Mint's HTTP/2 client accepts PUSHPROMISE frames from any server it connects to and inserts every promised stream into a per-connection map without consulting maxconcurrentstreams. A malicious or compromised HTTP/2 server can flood the client with PUSHPROMISE frames and withhold the matchi...

GHSA-G586-CCQF-7X4R mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

Summary Mint's HTTP/2 client accepts PUSHPROMISE frames from any server it connects to and inserts every promised stream into a per-connection map without consulting maxconcurrentstreams. A malicious or compromised HTTP/2 server can flood the client with PUSHPROMISE frames and withhold the matchi...

CVE-2026-47140

A flaw was found in vm2, an open-source virtual machine VM sandbox for Node.js. This vulnerability allows sandboxed code to bypass intended security restrictions by exploiting missing entries in the denylist for dangerous Node.js built-in functions, specifically process and inspector/promises. A...

CVE-2026-47140

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, workerthreads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach...

EUVD-2026-36448

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI WebAssembly.promising / WebAssembly.Suspending...

CVE-2026-47140 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, workerthreads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach...

CVE-2026-47140 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, workerthreads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach...

CVE-2026-47140 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, workerthreads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach...

CVE-2026-47140

CVE-2026-47140 - vm2 NodeVM denylist bypass : The vm2 sandbox (NodeVM) before version 3.11.4 did not block certain host-access primitives: processing modules like process and inspector/promises could be required from sandboxed code to bypass restrictions and execute code in the host process. Root...